feat(KAN-65): add signed macOS updates and DMG distribution

native/macos-ci.mjs

@@ -2,6 +2,8 @@ import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import {
     appendFileSync,
+    copyFileSync,
+    readlinkSync,
     existsSync,
     mkdirSync,
     mkdtempSync,
@@ -12,6 +14,7 @@ import {
 } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import process from 'node:process';
+import { updateSource } from './update-manifest.mjs';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import {
     appleTeamId,
@@ -28,9 +31,10 @@ export function releaseMetadata(
     const config = JSON.parse(
         readFileSync(join(directory, 'src-tauri/tauri.conf.json'), 'utf8'),
     );
-    const packageVersion = JSON.parse(
+    const nativePackage = JSON.parse(
         readFileSync(join(directory, 'package.json'), 'utf8'),
-    ).version;
+    );
+    const packageVersion = nativePackage.version;
     const cargoVersion = readFileSync(
         join(directory, 'src-tauri/Cargo.toml'),
         'utf8',
@@ -59,6 +63,23 @@ export function releaseMetadata(
             'The macOS product name and bundle identifier must stay unchanged.',
         );
     }
+    if (config.plugins?.updater?.pubkey !== updateSource.publicKey) {
+        throw new Error(
+            'The app updater key must match the permanent release key.',
+        );
+    }
+    if (
+        !/^\d+(?:\.\d+){0,2}$/.test(config.bundle?.macOS?.bundleVersion || '')
+    ) {
+        throw new Error(
+            'Set a numeric macOS bundleVersion for the About build number.',
+        );
+    }
+    if (!nativePackage.releaseNotes?.trim()) {
+        throw new Error(
+            'Add releaseNotes to native/package.json before publishing.',
+        );
+    }
     const target = env.MACOS_RELEASE_TARGET || 'aarch64-apple-darwin';
     const arch = {
         'aarch64-apple-darwin': 'arm64',
@@ -81,9 +102,11 @@ export function releaseMetadata(
     }
     return {
         version: config.version,
+        notes: nativePackage.releaseNotes,
         target,
         arch,
-        filename: `KanbanGit-${config.version}-${target}.zip`,
+        filename: `KanbanGit-${config.version}-${target}.dmg`,
+        updaterFilename: `KanbanGit-${config.version}-${target}.app.tar.gz`,
     };
 }
 
@@ -146,25 +169,65 @@ export function packageNotarizedApp({
     const staging = mkdtempSync(join(releaseRoot, '.pending-'));
     try {
         const archive = join(staging, metadata.filename);
-        run('ditto', [
-            '-c',
-            '-k',
-            '--sequesterRsrc',
-            '--keepParent',
-            app,
+        const bundle = join(root, metadata.target, 'release/bundle');
+        copyFileSync(
+            join(
+                bundle,
+                'dmg',
+                `KanbanGit_${metadata.version}_${metadata.arch === 'arm64' ? 'aarch64' : 'x64'}.dmg`,
+            ),
             archive,
+        );
+        const mounted = join(staging, 'mounted');
+        mkdirSync(mounted);
+        run('hdiutil', ['verify', archive]);
+        run('hdiutil', [
+            'attach',
+            archive,
+            '-readonly',
+            '-nobrowse',
+            '-mountpoint',
+            mounted,
         ]);
+        try {
+            if (
+                readlinkSync(join(mounted, 'Applications')) !== '/Applications'
+            ) {
+                throw new Error(
+                    'DMG must contain the Applications installation link.',
+                );
+            }
+            verifyNotarizedApp(join(mounted, 'KanbanGit.app'), metadata, run);
+        } finally {
+            run('hdiutil', ['detach', mounted]);
+        }
+        rmSync(mounted, { recursive: true, force: true });
+        const updateArchive = join(staging, metadata.updaterFilename);
+        copyFileSync(join(bundle, 'macos/KanbanGit.app.tar.gz'), updateArchive);
+        copyFileSync(
+            join(bundle, 'macos/KanbanGit.app.tar.gz.sig'),
+            `${updateArchive}.sig`,
+        );
+        if (!readFileSync(`${updateArchive}.sig`, 'utf8').trim()) {
+            throw new Error('The updater signature is missing.');
+        }
+        const extracted = join(staging, 'extracted');
+        mkdirSync(extracted);
+        run('tar', ['-xzf', updateArchive, '-C', extracted]);
+        verifyNotarizedApp(join(extracted, 'KanbanGit.app'), metadata, run);
+        rmSync(extracted, { recursive: true, force: true });
         const checksum = createHash('sha256')
             .update(readFileSync(archive))
             .digest('hex');
-        writeFileSync(
-            `${archive}.sha256`,
-            `${checksum}  ${metadata.filename}\n`,
-        );
-        const extracted = join(staging, 'extracted');
-        run('ditto', ['-x', '-k', archive, extracted]);
-        verifyNotarizedApp(join(extracted, 'KanbanGit.app'), metadata, run);
-        rmSync(extracted, { recursive: true, force: true });
+        for (const name of [metadata.filename, metadata.updaterFilename]) {
+            const hash = createHash('sha256')
+                .update(readFileSync(join(staging, name)))
+                .digest('hex');
+            writeFileSync(
+                join(staging, `${name}.sha256`),
+                `${hash}  ${name}\n`,
+            );
+        }
         renameSync(staging, destination);
         return { ...metadata, directory: destination, checksum };
     } finally {
@@ -191,6 +254,7 @@ if (
             appendFileSync(
                 process.env.GITHUB_OUTPUT,
                 Object.entries(output)
+                    .filter(([key]) => key !== 'notes')
                     .map(([key, value]) => `${key}=${value}\n`)
                     .join(''),
             );